Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 205 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| WF-52ca2269 | ivyforms < 1.5.2 |
HIGH | 8.8 | The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions… | 1.5.2 | wordfence |
| WF-52b04517 | acf-views < 3.7.20 |
HIGH | 8.8 | The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template… | 3.7.20 | wordfence |
| WF-528a28e7 | wpbookit-pro | HIGH | 8.8 | The WPBookit Pro - Appointment Booking Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file uploads… | — | wordfence |
| WF-527f8f08 | player-leaderboard < 1.0.3 |
HIGH | 8.8 | The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, … | 1.0.3 | wordfence |
| WF-5278e8d4 | health-check < 1.2.4 |
HIGH | 8.8 | The Health Check & Troubleshooting plugin for WordPress is vulnerable to unauthorized execution of AJAX actions by subsc… | 1.2.4 | wordfence |
| WF-525a2180 | bitformpro < 2.8.0 |
HIGH | 8.8 | The Bit Form Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a functi… | 2.8.0 | wordfence |
| WF-522b477f | wp-user-switch | HIGH | 8.8 | The WP User Switch plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.… | — | wordfence |
| WF-52203b9c | paid-member-subscriptions < 2.4.2 |
HIGH | 8.8 | The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, valid… | 2.4.2 | wordfence |
| WF-5217c992 | testimonial-slider-showcase-pro | HIGH | 8.8 | The Testimonial Slider And Showcase Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, an… | — | wordfence |
| WF-520df463 | radius-blocks | HIGH | 8.8 | The Radius Blocks plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.2.1. Th… | — | wordfence |
| WF-5205cc95 | wp-blog-post-layouts < 1.1.4 |
HIGH | 8.8 | The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including… | 1.1.4 | wordfence |
| WF-51fe2379 | sk-wp-settings-backup | HIGH | 8.8 | The SK WP Settings Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includ… | — | wordfence |
| WF-51d4b7f6 | idonate < 2.1.0 |
HIGH | 8.8 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Esca… | 2.1.0 | wordfence |
| WF-51d0ba58 | wpo365-login < 43.3 |
HIGH | 8.8 | The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43… | 43.3 | wordfence |
| WF-51cf2f40 | igniteup < 3.4.1 |
HIGH | 8.8 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. | 3.4.1 | wordfence |
| WF-51cd2cb8 | buddyforms | HIGH | 8.8 | The BuddyForms plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.8.17. This… | — | wordfence |
| WF-5184740a | ultimate-bootstrap-elements-for-elementor < 1.4.3 |
HIGH | 8.8 | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions… | 1.4.3 | wordfence |
| WF-517531ec | classified-listing < 4.2.1 |
HIGH | 8.8 | The Classified Listing plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.2.… | 4.2.1 | wordfence |
| WF-51634a0c | faqs-manager | HIGH | 8.8 | The FAQs Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.… | — | wordfence |
| WF-516261b5 | easy-property-listings < 3.4 |
HIGH | 8.8 | Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers … | 3.4 | wordfence |
| WF-515a5dfd | quickcal < 1.0.16 |
HIGH | 8.8 | The QuickCal plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.15. … | 1.0.16 | wordfence |
| WF-515502b5 | wp-photo-text-slider-50 < 8.1 |
HIGH | 8.8 | The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions u… | 8.1 | wordfence |
| WF-5143a2d2 | ultimate-member < 2.0.22 |
HIGH | 8.8 | The Arbitrary File Upload plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including,… | 2.0.22 | wordfence |
| WF-5137244c | cp-contact-form-with-paypal < 1.1.6 |
HIGH | 8.8 | The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with result… | 1.1.6 | wordfence |
| WF-5118ed50 | slider-hero < 8.2.7 |
HIGH | 8.8 | The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape… | 8.2.7 | wordfence |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →